On Wed, Nov 9, 2011 at 7:09 PM, PeterK <[log in to unmask]> wrote:

> Time to Get Physical (Hard Drives) | eLessons Learned
> *e-Lesson Learned:* It is important not to misrepresent the dates that
> documents were actually created because retyped “copies” are not actually
> copies. Once you go down this path, all your hard drives and storage
> devices can be physically analyzed and forensic images are just not good
> enough.
>
> Source: http://ellblog.com/?p=2725
>
>
I'm not sure characterizing 'retyped' documents/records as being 'copying'
is accurate.  That would be the same as saying files opened and re-saved on
a computer that has had it's system clock back-dated was 'copying' a file.

One other item that can cause a forensic nightmare that wasn't addressed
here, and is frequently left off stories similar to this, is what happens
when using certain legitimate duplication and data copying or drive imaging
applications.  Some of them will re-date the files EVEN THOUGH THEY ARE
ONLY MAKING A DIRECT COPY because the application sees that as an
'action'.  With certain applications, the date is changed when files are
copied to capture that action.

In a legal sense, this is obviously problematic... but even more so from a
business or operational sense when you're seeking information from a
specific time period.  It's important for users to understand the
operations performed by backup and imaging applications PRIOR to using them
and that they also log/document actions taken (and the purpose for the
action) when mirroring a hard drive prior to replacing it or upgrading a
system, or performing even routine or periodic backups.

Larry
[log in to unmask]

-- 
*Lawrence J. Medina
Danville, CA
RIM Professional since 1972*

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]